Your MCP client asks you to approve a server once. It never checks again. A server can serve one set of tool definitions on Monday and a different set on Tuesday, and because descriptions are read by the model as instructions, a changed description reaches as far as a changed system prompt.
mcp-pin freezes the names, descriptions, schemas and annotations a third-party stdio MCP server exposes. If any of it changes, the connection stops before your agent sees it. Separately, it keeps this public record of what those definitions were, and when they moved.
npx --yes mcp-pin@0.1.0 -- <your mcp server>
The MCP specification requires no integrity check on tool metadata, and no major client re-prompts when definitions change under an approved server. The approval you gave in January still stands in June, against content that did not stay still.
mcp-pin fingerprints the full metadata surface of every tool and re-derives that decision on every connect. No model sits in the trust path. It is a hash comparison, so it keeps working on the subtle changes a model would wave through.